Application Security Program Manager

JSM Consulting India is hiring a contract Application Security Program Manager for an onsite role in San Francisco, CA. This position owns the day-to-day vulnerability remediation program, starting with HackerOne bug bounty findings and application, API, and GraphQL authorization issues.

The contractor will coordinate the end-to-end remediation lifecycle across internal teams and external vendors, covering validation, tracking, routing, remediation accountability, and program closure. Strong application security fundamentals and tooling experience are essential, along with the ability to drive reporting and continuous process improvement using automation and GenAI.

Responsibilities

• Own day-to-day management of the HackerOne program, including vulnerability intake, triage, validation, routing, tracking, and closure.
• Coordinate weekly operating reviews with HackerOne and internal stakeholders.
• Track remediation commitments and drive accountability across teams.
• Manage disclosure and communication processes.
• Reproduce and validate reported vulnerabilities.
• Assess exploitability and business impact for findings.
• Apply expertise across web applications, REST APIs, GraphQL, authentication, and authorization issues.
• Use Postman, browser tooling, and security testing tools to validate findings.
• Support vulnerability prioritization based on customer and business risk.
• Coordinate remediation efforts across multiple engineering organizations.
• Work with engineering managers, technical leads, and product owners.
• Identify service ownership and route findings appropriately.
• Maintain tracking in Jira and ServiceNow.
• Escalate critical and overdue items.
• Produce executive-level reporting and dashboards.
• Track backlog trends, SLA compliance, remediation progress, and risk reduction.
• Present status updates to cybersecurity and engineering leadership.
• Leverage GenAI and workflow automation to improve vulnerability triage, remediation tracking, reporting, service ownership identification, and repetitive program-management activities.

Requirements

• 5+ years experience in Software Engineering or Application Security.
• Strong understanding of REST APIs, GraphQL, Authentication & Authorization, OAuth, JWT, OWASP Top 10, and API Security Top 10.
• Experience reproducing security findings.
• Experience using Postman.
• Experience with Jira and ServiceNow.
• Strong stakeholder management skills.
• Preferred: HackerOne or bug bounty experience.
• AppSec experience.
• Penetration testing experience.
• Full-stack software development background.
• Burp Suite experience.
• GenAI automation experience.

Job Details

• Location: San Francisco, CA (onsite)
• Job type: Contract
• Expected hours: 40.0 per week
• Pay: USD 80.00 to 85.00 per hour
• Minimum experience: 5 years

Technologies

• HackerOne
• Postman
• Jira
• ServiceNow
• REST APIs
• GraphQL
• OAuth
• JWT
• OWASP Top 10
• API Security Top 10
• Burp Suite
• GenAI